TUCoPS :: HP Unsorted T :: tb10070.htm

Takebishi Electric DeviceXplorer MELSEC OPC server multiple vulns
Multiple vulnerabilities in Takebishi Electric DeviceXplorer MELSEC OPC server
Multiple vulnerabilities in Takebishi Electric DeviceXplorer MELSEC OPC server




Multiple vulnerabilities in Takebishi Electric DeviceXplorer MELSEC OPC
server
============================================================================
OPC servers provide a standard way to interoperate automation and control
systems, bridging data from several industrial protocols such as DNP3,
MODBUS, etc. to a more standard data access interface. They are often used
in SCADA systems to consolidate network device information in a single
point; as such OPC servers are usually considered critical applications.

Takebishi Electric commercialises an OPC Server ("Takebishi.Melsec.1"), more
information is available at http://www.takebishi.co.jp/. 

ANALYSIS
--------

The product presents various security vulnerabilities, allowing an attacker
with access to the OPC interface to arbitrarily read and write the process
memory, leading to the execution of attacker-provided code.

The vulnerabilities reside in the server implementation of the following OPC
Data Access interface methods:

 * IOPCServer::RemoveGroup

By providing specially crafted OPC handles the attacker can force the server
to access arbitrary memory in read/write operations which can be leveraged
to execute arbitrary code in the OPC server.

VULNERABLE VERSIONS
-------------------

The vulnerability has been verified to be present in the following version
of the server:

  Server name: DeviceXPlorer MELSEC OPC Server
  OPC Server CLSID: {582516F0-849F-11D0-B627-0000F8211D82}
  ProgID: Takebishi.Melsec.1
  Version: 3.11.6
  OS: Windows XP

The vulnerability was discovered during an OPC server group assessment for a
customer and is not known to be publicly exploited.

WORKAROUND
----------

The vendor has fixed the vulnerability and published an updated version.

ADDITIONAL INFORMATION
----------------------

This vulnerability was found and researched by:

Lluis Mora  
Xavier Panadero  

You can find the latest version of this advisory at:

http://www.neutralbit.com/ 

Disclosure timeline:

  12/Jan/2006: Vendor notified
  12/Jan/2006: US-CERT notified
  16/Mar/2006: Vendor published public advisory
  21/Mar/2006: Neutralbit advisory published

References:

  CERT: US-CERT Vulnerability Note VU#926551
  CVE:  CVE-2007-1319


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH